@co0ontty/wand 2.1.1 → 2.2.0

package/README.md

@@ -13,6 +13,8 @@
 
 Wand is a web console for remotely accessing and managing local CLI tools from a browser. It is designed for [Claude Code](https://docs.anthropic.com/en/docs/claude-code) and [Codex](https://github.com/openai/codex), with terminal and structured conversation views, persistent resumable sessions, permission controls, file browsing, and native clients for multiple platforms.
 
+The browser password manager extension source lives in `browser-extension/`; setup and supported baseline features are documented in [docs/browser-extension.md](docs/browser-extension.md).
+
 <p align="center">
   <img src="docs/screenshots/clients-overview.png" width="100%" alt="Web centered with iOS and Android clients on both sides" />
 </p>

package/browser-extension/manifest.json

@@ -0,0 +1,42 @@
+{
+  "manifest_version": 3,
+  "name": "Wand Passwords",
+  "description": "Wand browser password manager with autofill, save prompts, cards, identities, TOTP, and security checks.",
+  "version": "0.1.0",
+  "permissions": [
+    "activeTab",
+    "clipboardWrite",
+    "contextMenus",
+    "webAuthenticationProxy",
+    "storage",
+    "scripting"
+  ],
+  "host_permissions": [
+    "https://home.huniu.fun:8183/*",
+    "http://127.0.0.1:*/*",
+    "http://localhost:*/*",
+    "https://127.0.0.1:*/*",
+    "https://localhost:*/*",
+    "<all_urls>"
+  ],
+  "background": {
+    "service_worker": "src/background.js",
+    "type": "module"
+  },
+  "action": {
+    "default_title": "Wand Passwords",
+    "default_popup": "src/popup.html"
+  },
+  "options_page": "src/options.html",
+  "content_scripts": [
+    {
+      "matches": [
+        "<all_urls>"
+      ],
+      "js": [
+        "src/content-script.js"
+      ],
+      "run_at": "document_idle"
+    }
+  ]
+}

package/browser-extension/shared/password-tools.mjs

@@ -0,0 +1,62 @@
+const COMMON_WEAK_PASSWORDS = new Set([
+  "123456",
+  "123456789",
+  "qwerty",
+  "password",
+  "111111",
+  "abc123",
+  "password1",
+  "iloveyou"
+]);
+
+export function generatePassword(options = {}) {
+  const length = clampInteger(options.length ?? 20, 8, 80);
+  const lower = "abcdefghijkmnopqrstuvwxyz";
+  const upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+  const digits = "23456789";
+  const symbols = "!@#$%^&*-_=+?";
+  const pools = [lower, upper];
+  if (options.digits !== false) pools.push(digits);
+  if (options.symbols !== false) pools.push(symbols);
+  const alphabet = pools.join("");
+  const chars = pools.map((pool) => randomChar(pool));
+  while (chars.length < length) chars.push(randomChar(alphabet));
+  return shuffle(chars).join("");
+}
+
+export function scorePasswordStrength(password) {
+  if (!password) return 0;
+  const value = String(password);
+  const lower = value.toLowerCase();
+  if (COMMON_WEAK_PASSWORDS.has(lower)) return 0;
+  let score = Math.min(40, value.length * 3);
+  if (/[a-z]/.test(value)) score += 10;
+  if (/[A-Z]/.test(value)) score += 10;
+  if (/\d/.test(value)) score += 10;
+  if (/[^A-Za-z0-9]/.test(value)) score += 15;
+  if (value.length >= 20) score += 15;
+  if (/(.)\1{2,}/.test(value)) score -= 20;
+  if (/^(?:[a-z]+|\d+)$/.test(value)) score -= 20;
+  return Math.max(0, Math.min(100, score));
+}
+
+function clampInteger(value, min, max) {
+  if (!Number.isFinite(value)) return min;
+  return Math.max(min, Math.min(max, Math.floor(value)));
+}
+
+function randomChar(alphabet) {
+  const values = new Uint32Array(1);
+  globalThis.crypto.getRandomValues(values);
+  return alphabet[values[0] % alphabet.length];
+}
+
+function shuffle(values) {
+  for (let i = values.length - 1; i > 0; i -= 1) {
+    const rand = new Uint32Array(1);
+    globalThis.crypto.getRandomValues(rand);
+    const j = rand[0] % (i + 1);
+    [values[i], values[j]] = [values[j], values[i]];
+  }
+  return values;
+}

package/browser-extension/shared/url-tools.mjs

@@ -0,0 +1,59 @@
+export const DEFAULT_BASE_URL = "https://home.huniu.fun:8183";
+
+export function normalizeBaseUrl(value) {
+  const raw = String(value || "").trim();
+  if (!raw) return DEFAULT_BASE_URL;
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return DEFAULT_BASE_URL;
+    parsed.hash = "";
+    parsed.search = "";
+    const pathname = parsed.pathname.replace(/\/+$/g, "");
+    return parsed.origin + (pathname === "/" ? "" : pathname);
+  } catch {
+    return DEFAULT_BASE_URL;
+  }
+}
+
+export function normalizeStoredUrl(value) {
+  const raw = String(value || "").trim();
+  if (!raw) return null;
+  try {
+    const parsed = new URL(raw.includes("://") ? raw : `https://${raw}`);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+    parsed.username = "";
+    parsed.password = "";
+    parsed.hash = "";
+    return parsed.origin + normalizePathname(parsed.pathname);
+  } catch {
+    return null;
+  }
+}
+
+export function urlsMatch(storedUrl, pageUrl) {
+  try {
+    const stored = new URL(normalizeStoredUrl(storedUrl) || storedUrl);
+    const page = new URL(pageUrl);
+    const storedHost = stored.hostname.toLowerCase();
+    const pageHost = page.hostname.toLowerCase();
+    if (pageHost !== storedHost && !pageHost.endsWith(`.${storedHost}`)) return false;
+    const storedPath = normalizePathname(stored.pathname);
+    return storedPath === "/" || normalizePathname(page.pathname).startsWith(storedPath);
+  } catch {
+    return false;
+  }
+}
+
+export function pageTitleFallback(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.hostname.replace(/^www\./, "");
+  } catch {
+    return "Login";
+  }
+}
+
+function normalizePathname(pathname) {
+  if (!pathname || pathname === "/") return "/";
+  return pathname.endsWith("/") ? pathname : `${pathname}/`;
+}

package/browser-extension/shared/webauthn-tools.mjs

@@ -0,0 +1,378 @@
+export const WEBAUTHN_ALGORITHM_ES256 = -7;
+
+export async function createPasskeyCredential(options) {
+  const rpId = resolveRpId(options);
+  const origin = resolveOrigin(options, rpId);
+  const challenge = requiredBase64Url(options.challenge, "challenge");
+  const userId = requiredBase64Url(options.user?.id, "user.id");
+  const userName = String(options.user?.name || "");
+  const userDisplayName = String(options.user?.displayName || userName || "");
+  ensureEs256Allowed(options.pubKeyCredParams || []);
+
+  const credentialIdBytes = randomBytes(32);
+  const credentialId = base64UrlEncode(credentialIdBytes);
+  const keyPair = await subtle().generateKey(
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["sign", "verify"]
+  );
+  const publicJwk = await subtle().exportKey("jwk", keyPair.publicKey);
+  const privateJwk = await subtle().exportKey("jwk", keyPair.privateKey);
+  const publicRaw = new Uint8Array(await subtle().exportKey("raw", keyPair.publicKey));
+  const cosePublicKey = encodeCosePublicKey(publicRaw);
+  const authData = await buildAuthenticatorData({
+    rpId,
+    flags: 0x45,
+    signCount: 0,
+    credentialIdBytes,
+    cosePublicKey
+  });
+  const attestationObject = cborEncode(new Map([
+    ["fmt", "none"],
+    ["attStmt", new Map()],
+    ["authData", authData]
+  ]));
+  const clientDataJSON = encodeClientData("webauthn.create", challenge, origin);
+  const response = {
+    id: credentialId,
+    rawId: credentialId,
+    type: "public-key",
+    authenticatorAttachment: "platform",
+    response: {
+      clientDataJSON: base64UrlEncode(clientDataJSON),
+      attestationObject: base64UrlEncode(attestationObject),
+      transports: ["internal", "hybrid"],
+      publicKeyAlgorithm: WEBAUTHN_ALGORITHM_ES256,
+      publicKey: base64UrlEncode(publicRaw),
+      authenticatorData: base64UrlEncode(authData)
+    },
+    clientExtensionResults: {}
+  };
+  const item = {
+    type: "passkey",
+    title: buildPasskeyTitle(options, rpId),
+    username: userName || userDisplayName || rpId,
+    urls: [origin],
+    fields: {
+      rpId,
+      origin,
+      credentialId,
+      userHandle: userId,
+      userName,
+      userDisplayName,
+      algorithm: String(WEBAUTHN_ALGORITHM_ES256),
+      signCount: "0",
+      publicKeyJwk: JSON.stringify(publicJwk),
+      privateKeyJwk: JSON.stringify(privateJwk),
+      publicKeyRaw: base64UrlEncode(publicRaw),
+      publicKeyCose: base64UrlEncode(cosePublicKey)
+    },
+    tags: ["passkey", "browser-extension"]
+  };
+  return { response, item, credentialId };
+}
+
+export async function getPasskeyAssertion(options, item) {
+  const fields = item?.fields || {};
+  const rpId = resolveRpId(options, fields.rpId);
+  const origin = resolveOrigin(options, rpId, fields.origin);
+  const challenge = requiredBase64Url(options.challenge, "challenge");
+  const credentialId = fields.credentialId;
+  const privateKeyJwk = parseJson(fields.privateKeyJwk, "privateKeyJwk");
+  if (!credentialId || !privateKeyJwk) {
+    throw new Error("Stored passkey is missing credential material.");
+  }
+  const credentialIdBytes = base64UrlDecode(credentialId);
+  const nextSignCount = Math.max(0, Number(fields.signCount || "0") || 0) + 1;
+  const authenticatorData = await buildAuthenticatorData({
+    rpId,
+    flags: 0x05,
+    signCount: nextSignCount
+  });
+  const clientDataJSON = encodeClientData("webauthn.get", challenge, origin);
+  const clientDataHash = await sha256(clientDataJSON);
+  const signedBytes = concatBytes(authenticatorData, clientDataHash);
+  const key = await subtle().importKey(
+    "jwk",
+    privateKeyJwk,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  const rawSignature = new Uint8Array(await subtle().sign({ name: "ECDSA", hash: "SHA-256" }, key, signedBytes));
+  const signature = maybeDerEncodeEcdsa(rawSignature);
+  const response = {
+    id: credentialId,
+    rawId: credentialId,
+    type: "public-key",
+    authenticatorAttachment: "platform",
+    response: {
+      authenticatorData: base64UrlEncode(authenticatorData),
+      clientDataJSON: base64UrlEncode(clientDataJSON),
+      signature: base64UrlEncode(signature),
+      userHandle: fields.userHandle || null
+    },
+    clientExtensionResults: {}
+  };
+  return { response, signCount: nextSignCount };
+}
+
+export function passkeyMatchesRequest(item, options) {
+  const fields = item?.fields || {};
+  const rpId = resolveRpId(options, fields.rpId);
+  if (fields.rpId !== rpId) return false;
+  const allowCredentials = Array.isArray(options.allowCredentials) ? options.allowCredentials : [];
+  if (!allowCredentials.length) return true;
+  return allowCredentials.some((credential) => credential?.id === fields.credentialId);
+}
+
+export function parseWebAuthnRequestJson(raw) {
+  if (typeof raw !== "string" || !raw.trim()) {
+    throw new Error("Missing WebAuthn request JSON.");
+  }
+  return JSON.parse(raw);
+}
+
+export function webAuthnDomException(name, message) {
+  return { name, message };
+}
+
+export function base64UrlEncode(value) {
+  const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 0x8000) {
+    binary += String.fromCharCode(...bytes.slice(i, i + 0x8000));
+  }
+  return btoaCompat(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+export function base64UrlDecode(value) {
+  const normalized = String(value || "").replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+  const binary = atobCompat(padded);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+export function cborEncode(value) {
+  const chunks = [];
+  encodeCborValue(value, chunks);
+  return concatBytes(...chunks);
+}
+
+export function maybeDerEncodeEcdsa(signature) {
+  if (signature[0] === 0x30) return signature;
+  if (signature.length !== 64) return signature;
+  const r = derInteger(signature.slice(0, 32));
+  const s = derInteger(signature.slice(32));
+  return concatBytes(
+    new Uint8Array([0x30]),
+    encodeDerLength(r.length + s.length),
+    r,
+    s
+  );
+}
+
+function buildPasskeyTitle(options, rpId) {
+  const rpName = options.rp?.name || rpId;
+  const user = options.user?.name || options.user?.displayName;
+  return user ? `${rpName} (${user})` : String(rpName);
+}
+
+function resolveRpId(options, fallback) {
+  const raw = options.rpId || options.rp?.id || fallback;
+  const rpId = String(raw || "").trim().toLowerCase();
+  if (!rpId) throw new Error("WebAuthn request has no rpId.");
+  return rpId;
+}
+
+function resolveOrigin(options, rpId, fallback) {
+  const raw = options.origin || options.topOrigin || fallback || `https://${rpId}`;
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error("invalid origin");
+    return parsed.origin;
+  } catch {
+    return `https://${rpId}`;
+  }
+}
+
+function ensureEs256Allowed(params) {
+  if (!Array.isArray(params) || !params.length) return;
+  const allowed = params.some((param) => Number(param?.alg) === WEBAUTHN_ALGORITHM_ES256);
+  if (!allowed) throw new Error("Only ES256 passkeys are supported.");
+}
+
+function requiredBase64Url(value, name) {
+  if (typeof value !== "string" || !value) throw new Error(`Missing ${name}.`);
+  base64UrlDecode(value);
+  return value;
+}
+
+async function buildAuthenticatorData(options) {
+  const rpIdHash = await sha256(new TextEncoder().encode(options.rpId));
+  const flags = new Uint8Array([options.flags]);
+  const signCount = new Uint8Array(4);
+  new DataView(signCount.buffer).setUint32(0, options.signCount, false);
+  if (!options.credentialIdBytes || !options.cosePublicKey) {
+    return concatBytes(rpIdHash, flags, signCount);
+  }
+  const aaguid = new Uint8Array(16);
+  const credLen = new Uint8Array(2);
+  new DataView(credLen.buffer).setUint16(0, options.credentialIdBytes.length, false);
+  return concatBytes(
+    rpIdHash,
+    flags,
+    signCount,
+    aaguid,
+    credLen,
+    options.credentialIdBytes,
+    options.cosePublicKey
+  );
+}
+
+function encodeCosePublicKey(publicRaw) {
+  if (publicRaw.length !== 65 || publicRaw[0] !== 4) {
+    throw new Error("Unexpected P-256 public key format.");
+  }
+  const x = publicRaw.slice(1, 33);
+  const y = publicRaw.slice(33, 65);
+  return cborEncode(new Map([
+    [1, 2],
+    [3, WEBAUTHN_ALGORITHM_ES256],
+    [-1, 1],
+    [-2, x],
+    [-3, y]
+  ]));
+}
+
+function encodeClientData(type, challenge, origin) {
+  return new TextEncoder().encode(JSON.stringify({
+    type,
+    challenge,
+    origin,
+    crossOrigin: false
+  }));
+}
+
+async function sha256(bytes) {
+  return new Uint8Array(await subtle().digest("SHA-256", bytes));
+}
+
+function subtle() {
+  if (!globalThis.crypto?.subtle) throw new Error("WebCrypto is unavailable.");
+  return globalThis.crypto.subtle;
+}
+
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  globalThis.crypto.getRandomValues(bytes);
+  return bytes;
+}
+
+function concatBytes(...parts) {
+  const length = parts.reduce((sum, part) => sum + part.length, 0);
+  const out = new Uint8Array(length);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+
+function encodeCborValue(value, chunks) {
+  if (value instanceof Uint8Array) {
+    encodeTypeAndLength(2, value.length, chunks);
+    chunks.push(value);
+    return;
+  }
+  if (typeof value === "string") {
+    const bytes = new TextEncoder().encode(value);
+    encodeTypeAndLength(3, bytes.length, chunks);
+    chunks.push(bytes);
+    return;
+  }
+  if (typeof value === "number") {
+    if (Number.isInteger(value) && value >= 0) {
+      encodeTypeAndLength(0, value, chunks);
+      return;
+    }
+    if (Number.isInteger(value) && value < 0) {
+      encodeTypeAndLength(1, -1 - value, chunks);
+      return;
+    }
+  }
+  if (Array.isArray(value)) {
+    encodeTypeAndLength(4, value.length, chunks);
+    value.forEach((item) => encodeCborValue(item, chunks));
+    return;
+  }
+  if (value instanceof Map) {
+    encodeTypeAndLength(5, value.size, chunks);
+    for (const [key, mapValue] of value.entries()) {
+      encodeCborValue(key, chunks);
+      encodeCborValue(mapValue, chunks);
+    }
+    return;
+  }
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value);
+    encodeTypeAndLength(5, entries.length, chunks);
+    for (const [key, objectValue] of entries) {
+      encodeCborValue(key, chunks);
+      encodeCborValue(objectValue, chunks);
+    }
+    return;
+  }
+  throw new Error("Unsupported CBOR value.");
+}
+
+function encodeTypeAndLength(type, length, chunks) {
+  const major = type << 5;
+  if (length < 24) {
+    chunks.push(new Uint8Array([major | length]));
+  } else if (length < 0x100) {
+    chunks.push(new Uint8Array([major | 24, length]));
+  } else if (length < 0x10000) {
+    chunks.push(new Uint8Array([major | 25, length >> 8, length & 0xff]));
+  } else {
+    const bytes = new Uint8Array(5);
+    bytes[0] = major | 26;
+    new DataView(bytes.buffer).setUint32(1, length, false);
+    chunks.push(bytes);
+  }
+}
+
+function derInteger(bytes) {
+  let start = 0;
+  while (start < bytes.length - 1 && bytes[start] === 0) start += 1;
+  let value = bytes.slice(start);
+  if (value[0] & 0x80) value = concatBytes(new Uint8Array([0]), value);
+  return concatBytes(new Uint8Array([0x02]), encodeDerLength(value.length), value);
+}
+
+function encodeDerLength(length) {
+  if (length < 0x80) return new Uint8Array([length]);
+  if (length < 0x100) return new Uint8Array([0x81, length]);
+  return new Uint8Array([0x82, length >> 8, length & 0xff]);
+}
+
+function parseJson(raw, name) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Stored passkey has invalid ${name}.`);
+  }
+}
+
+function btoaCompat(binary) {
+  if (typeof btoa === "function") return btoa(binary);
+  return Buffer.from(binary, "binary").toString("base64");
+}
+
+function atobCompat(value) {
+  if (typeof atob === "function") return atob(value);
+  return Buffer.from(value, "base64").toString("binary");
+}

package/browser-extension/src/api.js

@@ -0,0 +1,79 @@
+import { DEFAULT_BASE_URL, normalizeBaseUrl } from "../shared/url-tools.mjs";
+
+export const STORAGE_KEYS = {
+  baseUrl: "wand.baseUrl",
+  appToken: "wand.appToken",
+  passkeyProxyEnabled: "wand.passkeyProxyEnabled"
+};
+
+export function extensionStorage() {
+  if (globalThis.chrome?.storage?.local) return globalThis.chrome.storage.local;
+  throw new Error("Browser extension storage is unavailable.");
+}
+
+export async function getSettings() {
+  const data = await extensionStorage().get({
+    [STORAGE_KEYS.baseUrl]: DEFAULT_BASE_URL,
+    [STORAGE_KEYS.appToken]: "",
+    [STORAGE_KEYS.passkeyProxyEnabled]: true
+  });
+  return {
+    baseUrl: normalizeBaseUrl(data[STORAGE_KEYS.baseUrl]),
+    appToken: data[STORAGE_KEYS.appToken] || "",
+    passkeyProxyEnabled: data[STORAGE_KEYS.passkeyProxyEnabled] !== false
+  };
+}
+
+export async function saveSettings(settings) {
+  const payload = {};
+  if (settings.baseUrl !== undefined) payload[STORAGE_KEYS.baseUrl] = normalizeBaseUrl(settings.baseUrl);
+  if (settings.appToken !== undefined) payload[STORAGE_KEYS.appToken] = settings.appToken || "";
+  if (settings.passkeyProxyEnabled !== undefined) payload[STORAGE_KEYS.passkeyProxyEnabled] = settings.passkeyProxyEnabled !== false;
+  await extensionStorage().set(payload);
+}
+
+export async function loginToWand(baseUrl, password) {
+  const normalizedBase = normalizeBaseUrl(baseUrl);
+  const response = await fetch(`${normalizedBase}/api/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ password, client: "browser-extension" })
+  });
+  const data = await readJson(response);
+  if (!response.ok || !data.appToken) {
+    throw new Error(data.error || "Login failed.");
+  }
+  await saveSettings({ baseUrl: normalizedBase, appToken: data.appToken });
+  return { baseUrl: normalizedBase, appToken: data.appToken, serverUrl: data.serverUrl };
+}
+
+export async function apiFetch(path, options = {}) {
+  const settings = await getSettings();
+  if (!settings.appToken) {
+    throw new Error("Wand extension is locked. Sign in from Options.");
+  }
+  const headers = {
+    "Content-Type": "application/json",
+    ...(options.headers || {}),
+    Authorization: `Bearer ${settings.appToken}`
+  };
+  const response = await fetch(`${settings.baseUrl}${path}`, {
+    ...options,
+    headers
+  });
+  const data = await readJson(response);
+  if (!response.ok) {
+    throw new Error(data.error || `Request failed with ${response.status}.`);
+  }
+  return data;
+}
+
+export async function readJson(response) {
+  const text = await response.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { error: text };
+  }
+}